InfoSecBulletin Cybersecurity for mankind
Citrix has issued security updates for a serious vulnerability in the NetScaler Console and NetScaler Agent that could allow privilege escalation in specific situations. The vulnerability, identified as CVE-2024-12284, has been given a CVSS v4 score of 8.8 out of a maximum of 10.0
It involves improper handling of user privileges that could allow a user with access to elevate their permissions and perform additional actions if the NetScaler Console Agent is in use.
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
“The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization,” Netscaler noted.
“However, only authenticated users with existing access to the NetScaler Console can exploit this vulnerability, thereby limiting the threat surface to only authenticated users.”
“The issue impacts the following versions:”
NetScaler Console 14.1 before 14.1-38.53
NetScaler Console 13.1 before 13.1-56.18
NetScaler Agent 14.1 before 14.1-38.53
NetScaler Agent 13.1 before 13.1-56.18
It has been remediated in the below versions of the software –
NetScaler Console 14.1-38.53 and later releases
NetScaler Console 13.1-56.18 and later releases of 13.1
NetScaler Agent 14.1-38.53 and later releases
NetScaler Agent 13.1-56.18 and later releases of 13.1
“Cloud Software Group strongly urges customers of NetScaler Console and NetScaler Agent to install the relevant updated versions as soon as possible,” the company said, adding there are no workarounds to resolve the flaw.
Customers using Citrix-managed NetScaler Console Service do not need to take any action.
